fix(firewall): correct rules so that kubernetes hosts are added to firewall allowed hosts

!5 #2

defaults/main.yml

@@ -37,30 +37,6 @@ nfc_kubernetes:
 
 k3s:
   files:
-    # - name: config.yaml
-    #   path: /etc/rancher/k3s
-    #   content: |
-    #     flannel-backend: none
-    #     cluster-cidr: "{{ KubernetesPodSubnet }}"
-    #     cluster-init: true
-    #     {% if not Kubernetes_Prime | default(false) | bool -%}server: https://{{ hostvars[kubernetes_config.cluster.prime.name].ansible_host }}:6443{% endif %}
-    #     service-cidr: "{{ KubernetesServiceSubnet }}"
-    #     disable-network-policy: true
-    #     disable:
-    #       - traefik
-    #     kube-apiserver-arg:
-    #       - audit-log-path=/var/lib/rancher/k3s/server/logs/audit.log
-    #       - audit-policy-file=/var/lib/rancher/k3s/server/audit.yaml
-    #       # - admission-control-config-file=/var/lib/rancher/k3s/server/psa.yaml
-    #       {% if kubernetes_oidc.enabled | default(false) | bool -%}
-    #       - oidc-issuer-url={{ kubernetes_oidc.issuer_url }}
-    #       - oidc-client-id={{ kubernetes_oidc.client_id }}
-    #       - oidc-username-claim={{ kubernetes_oidc.username_claim }}
-    #       - {% if kubernetes_oidc.oidc_username_prefix | default('') != '' %}oidc-username-prefix={{ kubernetes_oidc.oidc_username_prefix }}{% endif %}
-    #       - oidc-groups-claim={{ kubernetes_oidc.groups_claim }}
-    #       {% if kubernetes_oidc.groups_prefix | default('') != '' %}- oidc-groups-prefix={{ kubernetes_oidc.groups_prefix }}{% endif %}
-    #     {% endif %}
-    #     node-external-ip: "{{ host_external_ip }}"
 
     - name: audit.yaml
       path: /var/lib/rancher/k3s/server
@@ -104,7 +80,6 @@ k3s:
       when: "{{ kubernetes_config.cluster.prime.name == inventory_hostname }}"
 
 
-
 #############################################################################################
 # Cluster Config when stored in Inventory
 #
@@ -118,6 +93,7 @@ k3s:
 #       - '2001:4860:4860::8888'
 #       - '192.168.1.1'
 #     Name: earth                       # Mandatory, String. Cluster Name
+#     group_name:                       # Mandatory, String. name of the ansible inventory group containg all cluster hosts
 #     prime:
 #       name: k3s-prod                  # Mandatory, String. Ansible inventory_host that will
 #                                       # act as the prime master node.

templates/iptables-kubernetes.rules.j2

@@ -31,8 +31,9 @@
 
 {%- endif -%}
 
-{%- for kubernetes_host in groups[kubernetes_type] -%}
+{%- for kubernetes_host in groups[kubernetes_config.cluster.group_name] -%}
 
+    {%- set kubernetes_host = hostvars[kubernetes_host].ansible_host -%}
 
     {%- if kubernetes_host is regex('^[a-z]') and ':' not in kubernetes_host -%} {#- Convert DNs name to IP Address -#}
 
@@ -46,7 +47,11 @@
 
       {%- endif -%}
 
-      {%- if kubernetes_host | list | length > 0 -%} {#- Convert dns lookup to list, and select the first item -#}
+      {%- if 
+        kubernetes_host is iterable
+          and
+        kubernetes_host is not string
+        -%} {#- Convert dns lookup to list, and select the first item -#}
         {%- set kubernetes_host = kubernetes_host | from_yaml_all | list -%}
 
         {%- set kubernetes_host = kubernetes_host[0] -%} 
@@ -57,6 +62,9 @@
 
     {%- for master_host in groups['kubernetes_master'] -%}
 
+      {%- if master_host in groups[kubernetes_config.cluster.group_name] -%}
+
+        {%- set master_host = hostvars[master_host].ansible_host -%}
 
         {%- if master_host is regex('^[a-z]')  and ':' not in master_host -%} {#- Convert DNs name to IP Address -#}
 
@@ -111,6 +119,8 @@
 
         {%- endif -%}
 
+      {%- endif -%}
+
     {%- endfor -%}
 
     {%- if 
@@ -133,12 +143,25 @@
 
       {#- All cluster Hosts -#}
 
+
+      {%- if Kubernetes_Master | default(false) | bool -%}
+
+        {%- set data.firewall_rules = data.firewall_rules + ['-I kubernetes-api -s ' + kubernetes_host + ' -j ACCEPT'] -%}
+
+      {%- endif -%}
+
       {%- set data.firewall_rules = data.firewall_rules + ['-I kubelet-metrics -s ' + kubernetes_host + ' -j ACCEPT'] -%}
 
+      {%- set data.firewall_rules = data.firewall_rules + ['-I kubernetes-flannel-wg-four -s ' + kubernetes_host + ' -j ACCEPT'] -%}
+
+      {%- set data.firewall_rules = data.firewall_rules + ['-I kubernetes-flannel-wg-six -s ' + kubernetes_host + ' -j ACCEPT'] -%}
+      
+
     {%- endif -%}
 
 {%- endfor -%}
 
+{%- if Kubernetes_Master | default(false) | bool -%}
 
   {%- for api_client in kubernetes_config.cluster.access | default([]) -%}
 
@@ -193,6 +216,8 @@
 
   {%- endfor %}
 
+{%- endif %}
+
 *filter
 
 {# -N kubernetes-embedded-etcd